Pith. sign in

REVIEW 4 major objections 5 minor 33 references

Fast Fourier Transform-Based Spectral and Temporal Gradient Filtering for Differential Privacy

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FFTKF reshapes DP noise toward high frequencies and reports higher test accuracy than DP-SGD and DiSK at the same privacy budget.

desk verdict A plausible combination of FFT noise shaping and Kalman filtering, but the central privacy claim is unsupported because the finite-difference prediction step’s extra gradient queries are never accounted for. read the letter →

arxiv 2505.04468 v2 pith:AZBKCJCA submitted 2025-05-07 cs.LG cs.AIcs.ITcs.NEmath.IT

Hyeju Shin , Vincent-Daniel , Kyudan Jung , Seongwon Yun This is my paper · ORCID
classification cs.LGcs.AIcs.ITcs.NEmath.IT
keywords differentialprivacyDP-SGDKalmanfilterFastFourierTransformnoiseshapingprivateoptimizationgradientdenoisingfrequency-domainfiltering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FFTKF is proposed as a drop-in differentially private optimizer that applies a frequency-domain mask to privatized gradients and then a scalar-gain Kalman filter. The paper's central claim is that this reshaping preserves the same $(\varepsilon,\delta)$ guarantee as DP-SGD and DiSK, because the FFT is unitary and the mask is a data-independent post-processing step, while it pushes privacy noise into high-frequency components that contribute least to learning. The payoff would be consistent test-accuracy gains on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet across CNNs, Wide ResNets, and Vision Transformers, at a per-iteration cost of $O(d\log d)$. A theoretical bound asserts a tighter privacy-utility trade-off through reduced noise variance and controlled bias.

What carries the argument

The load-bearing object is the linear spectral filter $G_\rho=\mathcal{F}^{-1}\Phi_\rho\mathcal{F}$, which multiplies each Fourier coefficient of the privatized gradient by $1$ below a pivot index $k_0=\lfloor\lambda d\rfloor$ and by $1-\rho e^{-\alpha(k-k_0)}$ above it. This filter does not increase $\ell_2$ sensitivity and is data-independent, so it can be applied after noise addition without changing the DP guarantee; its eigenvalue structure (eigenvalues $1$ repeated $k_0$ times and $1-\rho$ repeated $d-k_0$ times) is what produces the claimed variance reduction $\rho^\star$ and the bias term in Theorem 2. The second component is a scalar-gain Kalman update $\tilde{g}_t=(1-\kappa)\tilde{g}_{t-1}+\kappa\hat{g}_t$, where $\hat{g}_t$ is the filtered observation and the prediction step uses a privatized finite-difference formula to approximate the Hessian action $H_t d_{t-1}$ from two extra clipped gradient evaluations. Together the two pieces give per-iteration complexity $O(d\log d)$ plus $O(d)$ vector operations.

What would settle it

Run a complete moments accountant that treats the two clipped finite-difference gradient evaluations in Eq. (22) as separate data-dependent queries per iteration, and check whether the reported $(\varepsilon,\delta)$ still holds; if the budget is exceeded, the same-budget privacy claim is void. A cheaper side check is to disable the finite-difference prediction term and measure how much of the reported accuracy gain disappears, revealing how much of the improvement rides on those extra queries.

Watch

Extended reading notes

Core claim

The paper argues that private gradient noise need not be fought only in the time domain: by transforming a clipped, noised gradient with an FFT, attenuating high-frequency Fourier coefficients with a soft mask $\Phi_\rho$, and transforming back, the noise is concentrated in spectral regions that matter least for optimization, while the low-frequency gradient signal is preserved. Because the filter is unitary-norm-preserving and data-independent, the paper claims the exact $(\varepsilon,\delta)$ budget of DP-SGD/DiSK is inherited through post-processing. Lemma 1 quantifies the effect: the filtered noise covariance becomes $\sigma_w^2 A^2$ with trace $\rho^\star d\sigma_w^2$, where $\rho^\star=[k_0+(1-\rho)^2(d-k_0)]/d$, and the signal is scaled by a matrix within distance $\rho$ of the identity; Theorem 2 then bounds the average squared gradient norm with the noise term reduced and a bias term $\rho^2 G_T$ added. Empirically, the paper reports that FFTKF beats DP-Adam and DiSK at $\varepsilon=4$ on all tested datasets, with gains up to 1.6 percentage points on CIFAR-10 with WRN-40.

Load-bearing premise

The reported privacy guarantee assumes that the two extra clipped gradient evaluations in the finite-difference prediction step (Eq. 22) consume no additional privacy budget or are fully included in the moments accountant, yet the paper only proves post-processing for the FFT-filtered observation, not for these additional data-dependent queries.

Editorial extensions

If this is right

  • The method can be inserted into existing DP-SGD or DP-Adam training loops by adding one forward pass, two FFTs, and scalar updates per step, so the accuracy gains come at modest extra cost.
  • With the paper's fixed choices $\lambda=1/2$ and $\rho=0.5$, the DP-noise term in the convergence bound is cut by 37.5% while the added bias penalty is at most 25%, which is the quantitative sense in which the trade-off improves on DiSK.
  • Reported gains at $\varepsilon=4$ hold across four datasets and five architectures, so the benefit is not restricted to one model family.
  • If the guarantee holds, FFTKF offers a way to spend the same privacy budget more efficiently, which matters most under tight budgets where plain DP-SGD collapses in accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A consequence the paper leaves implicit is that a full privacy audit must count the two clipped finite-difference gradient evaluations per iteration in Eq. (22) as data-dependent queries; the post-processing argument covers only the FFT filtering of the observation, so the true privacy cost of the prediction step is an open question.
  • A testable extension would be to measure a model's gradient power spectrum before applying FFTKF: on tasks where signal energy concentrates at low frequencies the mask should help, and on tasks with flat spectra it should remove genuine signal and hurt, predicting dataset-dependent gains.
  • The same spectral-shaping idea could be layered onto other private optimizers that inject per-step Gaussian noise, since the post-processing argument is mechanism-agnostic; the main design question would be whether a temporal model cheaper than the finite-difference Kalman step can deliver similar denoising.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes FFTKF, a differentially private optimizer that applies an FFT-based spectral mask to privatized gradients and combines this with a scalar-gain Kalman filter that includes a finite-difference prediction step. The authors claim that FFTKF preserves the (ε,δ)-DP guarantee of the base DP-SGD/DiSK optimizer while achieving higher test accuracy on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet across CNNs, Wide ResNets, and Vision Transformers, with per-iteration complexity O(d log d). A theoretical analysis is presented through Lemma 1 and Theorem 2, and experiments compare FFTKF against DPAdam and DiSK.

Significance. If the central claim were established, FFTKF would be a practically valuable contribution: it is a drop-in private optimizer with a plausible O(d log d) complexity, and the reported accuracy gains over DiSK are consistent across many architectures and datasets. The FFT post-processing step itself is correctly identified as privacy-preserving, and the broad experimental scope is a strength. However, the paper's privacy guarantee for the full algorithm is not established: the finite-difference prediction step makes additional data-dependent gradient queries that are not covered by the post-processing argument, and no moments-accountant or RDP analysis is given for them. The theoretical convergence bound is also circular as stated. These issues undermine the paper's main claims.

major comments (4)
  1. The finite-difference prediction step in Eq. (22) evaluates and clips gradients at x_t + γ d_{t-1} and x_t, with additional noise w^fd_t. These are fresh data-dependent queries; d_{t-1} itself depends on previous private gradients, so the queried points are adaptively chosen. The privacy argument in Sec. 3.5 and Proposition 1 covers only the post-processing map P(g_t) = F^{-1}Φ_ρ F g_t applied to the clipped Gaussian observation. It does not cover the two additional clipped gradient evaluations in Eq. (22). The claim that Algorithm 1 "inherits exactly the same (ε,δ) guarantee as standard DP-SGD/DiSK" is therefore unsupported. A valid analysis would need a moments accountant or RDP composition that includes, at each iteration, the DP-SGD query plus the finite-difference query with sensitivity proportional to C/γ and noise scale σ_fd. Without this, the reported ε=4 is an undercount and the privacy-utility comparisons are not valid.
  2. The displayed bound in Theorem 2 has Σ_t E‖∇F(x_t)‖² on the left-hand side and a term ρ² G_T on the right-hand side, where G_T is defined as the same average (1/T) Σ_t E‖∇F(x_t)‖². As written, the inequality is circular and does not establish convergence. The statement needs to be reformulated, for example by moving the G_T term to the left-hand side under a condition such as C_1 > ρ², or by presenting a recursion that yields a non-circular final bound. This is a load-bearing issue because Theorem 2 is the paper's main theoretical privacy-utility result.
  3. Theorem 2 refers to "Assumptions A1–A3" and to "the same (η,κ,γ) schedule as in Algorithm 1," but the assumptions A1–A3 are never stated in the manuscript; they need to be given explicitly or precisely referenced to [32]. In addition, the proof of Lemma 1 says it follows from the post-processing theorem of differential privacy, but Lemma 1 is an algebraic statement about the mean and covariance of the filtered gradient; the post-processing theorem is irrelevant to that computation. The proof should instead directly use unitary invariance of the Fourier transform.
  4. The experimental section reports accuracy at ε=4 without specifying the exact batch sizes, number of epochs, learning rates, noise scales σ_w and σ_fd, or the moments-accountant parameters used to compute ε. The text says these were "experimentally adjusted" to achieve optimal performance, which is not reproducible and, given the missing privacy accounting for Eq. (22), prevents the reader from verifying that the reported accuracies are actually attained under the claimed (ε,δ) budget. Full hyperparameter tables and a corrected privacy computation are needed before the empirical claims can be assessed.
minor comments (5)
  1. In Eq. (21) the first sum is divided by B (1/B Σ clip) but the second sum in Eq. (22) is not divided by B; this is inconsistent and should be fixed to make the batch-averaging convention explicit.
  2. The text refers to "Lemma 4" at the end of Section 3.5 ("Lemma 4 replaces the isotropic noise term...") although only Lemma 1 is stated in Section 4; the numbering is inconsistent and the references should be harmonized.
  3. There is a typo in the sentence "the termFFTKF-is employed to denote..." — the stray hyphen should be removed.
  4. Reference [6], "John Doe and Jane Smith," appears to be a placeholder rather than a real citation; it should be replaced with the actual source or removed.
  5. The claim of "consistent" improvement over DiSK is not fully supported by the reported numbers; for example, on Tiny-ImageNet with CNN5 the accuracy drops from 23.45 (DISK) to 22.62 (FFTKF), and on CIFAR-100 with ViT-small the gain is only 0.02 percentage points. The text should qualify the consistency claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FFTKF's mask constants are fixed a priori and its Kalman structure is explicitly imported from external prior work, not from a self-citation chain.

full rationale

FFTKF's derivation is not circular in the senses enumerated by the rubric. The spectral mask parameters are fixed a priori with lambda = 1/2 and rho = 0.5, and the derived constants rho* = 0.625 and rho^2 = 0.25 are algebraic consequences of the chosen mask, not quantities fitted to the accuracy results; thus the empirical comparison is not a fitted-input-called-prediction. The scalar-gain Kalman structure is explicitly adopted from DiSK [32], an external prior work with no author overlap with the present paper, and Theorem 2 is presented as 'Repeating the steps of Theorem 2 [32]', which is standard use of prior work rather than a load-bearing self-citation. The only self-referential-looking element is Theorem 2's displayed bound, which contains G_T on both sides; however, because the coefficient rho^2 = 0.25 < 1, this is a standard fixed-point inequality that can be rearranged into a closed-form bound, so it is not a definitional equivalence between the claimed result and its input. The genuine weakness in the paper is a soundness gap rather than circularity: the finite-difference prediction step in Eq. (22) queries clipped gradients at adaptively chosen points x_t + gamma d_{t-1} and x_t with added noise w_fd, and Section 3.5's post-processing argument covers only the FFT map P(g_t), not these additional data-dependent queries. If unaccounted, that would undermine the claimed (epsilon, delta) budget, but it is an omitted privacy analysis, not a reduction of the method's output to its own input. Therefore the circularity score is 0.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several free hyperparameter choices and unstated assumptions. The most fragile inputs are the spectral-separation assumption (that flattened parameter vectors have informative low-frequency components) and the completeness of the privacy accounting for the finite-difference prediction step. The theoretical bound also depends on DiSK's Assumptions A1-A3, which are not stated in this paper.

free parameters (7)
  • lambda (FFT pivot fraction) = 0.5 (fixed a priori)
    Defines k0 = floor(lambda d) in Eq. (9) and Eq. (29); the paper fixes lambda = 1/2 in all experiments, which determines the noise reduction coefficient rho* = 0.625.
  • rho (high-frequency attenuation) = 0.5 in main results; 0.6 recommended in ablation
    Controls suppression of high-frequency components in the spectral mask; chosen a priori and varied in ablation, not fitted to data, but central to the claimed noise reduction.
  • kappa (Kalman gain)
    Balances prediction vs observation in Eq. (C); no values or tuning protocol reported.
  • gamma (finite-difference step)
    Appears in Eq. (22) and Eq. (26); no values reported.
  • sigma_w, sigma_fd (noise scales)
    Required for the DP guarantee and for the finite-difference step; not reported, so the actual (epsilon, delta) achieved cannot be checked.
  • learning rate eta, batch size B, epochs E
    Adjusted per dataset for 'optimal performance' in Sec. 5.1; values not reported.
  • alpha (mask decay)
    Appears in the exponential high-frequency mask of Eq. (17) but not in the theoretical mask of Eq. (29) and is never specified.
assumptions (5)
  • ad hoc to paper Low-frequency components of the FFT of the flattened parameter vector carry most gradient signal, and high frequencies carry mostly DP noise
    Sec. 3.1 states 'most useful gradient information, especially in gradient vectors of smooth loss landscapes, is concentrated in the lower spectral range'. This is asserted, not derived, and parameter ordering is arbitrary, so the FFT basis has no intrinsic frequency meaning for the loss landscape.
  • domain assumption Assumptions A1-A3 from DiSK [32] (smoothness, convexity-like conditions, bounded gradients) hold
    Theorem 2 in Sec. 4 relies on them: 'Under Assumptions A1-A3 ... Repeating the steps of Theorem 2 [32]'; they are not stated in this paper.
  • standard math Post-processing property of differential privacy applies to the FFT filter
    Prop. 1 claims this correctly for P(g_t) alone, but the paper extends it to the full algorithm without accounting for the finite-difference step.
  • standard math Gaussian mechanism with moments accountant as in DP-SGD/DiSK
    Used to claim 'exactly the same (epsilon, delta)' as DP-SGD/DiSK; the additional w_fd noise in Eq. (22) is not included in the accounting.
  • domain assumption Scalar-gain Kalman simplification with isotropic covariances is valid for gradient dynamics
    Assumed in Sec. 3.4, inherited from DiSK, and not verified for the models and datasets used here.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fast Fourier Transform-Based Spectral and Temporal Gradient Filtering for Differential Privacy." pith.science (2026). https://pith.science/paper/AZBKCJCA

@misc{pith2026250504468,
  author       = {Pith},
  title        = {Pith review of: Fast Fourier Transform-Based Spectral and Temporal Gradient Filtering for Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AZBKCJCA}},
  note         = {Machine review of arXiv:2505.04468}
}
abstract

Differential Privacy (DP) has emerged as a key framework for protecting sensitive data in machine learning, but standard DP-SGD often suffers from significant accuracy loss due to injected noise. To address this limitation, we introduce the FFT-Enhanced Kalman Filter (FFTKF), a differentially private optimization method that improves gradient quality while preserving $(\varepsilon, \delta)$-DP guarantees. FFTKF applies frequency-domain filtering to shift privacy noise into less informative high-frequency components, preserving the low-frequency gradient signals that carry most learning information. A scalar-gain Kalman filter with a finite-difference Hessian approximation further refines the denoised gradients. The method has per-iteration complexity $\mathcal{O}(d \log d)$ and achieves higher test accuracy than DP-SGD and DiSK on MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet with CNNs, Wide ResNets, and Vision Transformers. Theoretical analysis shows that FFTKF ensures equivalent privacy while delivering a stronger privacy--utility trade-off through reduced variance and controlled bias.

Figures

Figures reproduced from arXiv: 2505.04468 by the authors.

Figure 1
Figure 1. Illustration of the Differentially Private [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visualization of the proposed frequency-domain gradient denoising process. (A) Original [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Left: Test accuracy (%) under (ϵ = 4) across four datasets and five model architectures. Right: Test accuracy across (ρ, ϵ) at epoch 40. Proof. Unitary invariance of F yields the stated mean and covariance. Eigenvalues of A are 1 (multiplicity k0) and 1 − ρ (multiplicity d − k0). Remark. “Bias” in Lemma 4 refers to E[ˆgt] − ∇F(xt); filtering does not introduce systematic noise bias but scales the signal by A. Lemma … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Test accuracy curves at ϵ = 4 across four datasets (CIFAR10 [14], CIFAR100 [14], MNIST [17], Tiny-ImageNet [16]) and five model architectures. Each plot compares DPAdam [27] (green), DISK [32] (blue), and the proposed FFTKF-DPAdam (red). FFTKF consistently improves fin…
Figure 5
Figure 5. Figure 5: Ablation study of FFTKF. (a) Varying ϵ at epoch 80. (b) Varying ϵ at epoch 40. of datasets and models. For example, when applied to CIFAR-10 with Wide ResNet-40, FFTKF demonstrates a test accuracy enhancement of up to 1.6% over the best-performing state-of-the-art algo…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 21 canonical work pages

  1. [6]

    Fourier transform-based optimization of particle velocity estimation for noise reduction in tracking experiments.Journal of Signal Processing, 35(4):123–135, 2025

    John Doe and Jane Smith. Fourier transform-based optimization of particle velocity estimation for noise reduction in tracking experiments.Journal of Signal Processing, 35(4):123–135, 2025

    work page 2025

  2. [32]

    DiSK: Differentially private optimizer with simplified kalman filter for noise reduction

    Xinwei Zhang, Zhiqi Bu, Borja Balle, Mingyi Hong, Meisam Razaviyayn, and Vahab Mirrokni. DiSK: Differentially private optimizer with simplified kalman filter for noise reduction. InThe Thirteenth International Conference on Learning Representations, 2025

    work page 2025

  3. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. 10

    work page 2016

  4. [2]

    Brendan McMahan, and Swaroop Ramaswamy

    Galen Andrew, Om Thakkar, H. Brendan McMahan, and Swaroop Ramaswamy. Differentially private learning with adaptive clipping, 2022

    work page 2022

  5. [3]

    R. N. Bracewell.The Fourier Transform and Its Applications. McGraw-Hill, 1999

    work page 1999

  6. [4]

    Briggs and Van Emden Henson.The DFT: An Owner’s Manual for the Discrete Fourier Transform

    William L. Briggs and Van Emden Henson.The DFT: An Owner’s Manual for the Discrete Fourier Transform. Society for Industrial and Applied Mathematics, Philadelphia, 1995

    work page 1995

  7. [5]

    D. Chen, Y . Liu, and S. Cao. Differentially private optimization with low-pass filtering. In International Conference on Machine Learning, 2023

    work page 2023

  8. [7]

    An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020

    arXiv 2010

Show all 33 references
  1. [8]

    Now Publishers Inc., 2014

    Cynthia Dwork and Aaron Roth.The Algorithmic Foundations of Differential Privacy, volume 9 ofFoundations and Trends in Theoretical Computer Science. Now Publishers Inc., 2014

    2014

  2. [9]

    Eldar and V olker Pohl

    Yonina C. Eldar and V olker Pohl. Recovering signals from lowpass data.IEEE Transactions on Signal Processing, 58(5):2636–2646, May 2010

    2010

  3. [10]

    An adaptive approach to real-time aggregate monitoring with differential privacy.IEEE Transactions on Knowledge and Data Engineering, 25(7):1469–1483, 2013

    Li Fan and Li Xiong. An adaptive approach to real-time aggregate monitoring with differential privacy.IEEE Transactions on Knowledge and Data Engineering, 25(7):1469–1483, 2013

    2013

  4. [11]

    Spectral filtering for general linear dynamical systems, 2018

    Elad Hazan, Holden Lee, Karan Singh, Cyril Zhang, and Yi Zhang. Spectral filtering for general linear dynamical systems, 2018

    2018

  5. [12]

    Kasanický, J

    I. Kasanický, J. Mandel, and M. Vejmelka. Spectral diagonal ensemble kalman filters.Nonlinear Processes in Geophysics, 22(4):485–497, August 2015

    2015

  6. [13]

    D. P. Kingma and J. Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  7. [14]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  8. [15]

    Imagenet classification with deep convolutional neural networks.Communications of the ACM, 60(6):84–90, 2017

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks.Communications of the ACM, 60(6):84–90, 2017

    2017

  9. [16]

    Tiny imagenet visual recognition challenge.CS 231N, 7(7):3, 2015

    Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge.CS 231N, 7(7):3, 2015

    2015

  10. [17]

    Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

    1998

  11. [18]

    Random noise reduction using svd in the frequency domain

    Baotong Liu and Qiyuan Liu. Random noise reduction using svd in the frequency domain. Journal of Petroleum Exploration and Production Technology, 10:3081–3089, 2020

    2020

  12. [19]

    On the utility and protection of optimization with differential privacy and classic regularization techniques, 2022

    Eugenio Lomurno and Matteo matteucci. On the utility and protection of optimization with differential privacy and classic regularization techniques, 2022

    2022

  13. [20]

    Kalman filter-based differential privacy federated learning method.Applied Sciences, 12(15):7787, 2022

    Xiaoyang Ma et al. Kalman filter-based differential privacy federated learning method.Applied Sciences, 12(15):7787, 2022

    2022

  14. [21]

    Jerome Le Ny and George J. Pappas. Differentially private kalman filtering, 2012

    2012

  15. [22]

    Adaptive low-pass filtering using sliding window gaussian processes

    Alejandro J Ordóñez-Conejo, Armin Lederer, and Sandra Hirche. Adaptive low-pass filtering using sliding window gaussian processes. In2022 European Control Conference (ECC), pages 2234–2240. IEEE, 2022

    2022

  16. [23]

    Pichapati, A

    V . Pichapati, A. T. Suresh, and F. X. Yu. Adaclip: Adaptive clipping for private sgd.arXiv preprint arXiv:1908.07643, 2019

    1908 arXiv

  17. [24]

    Robbins and S

    H. Robbins and S. Monro. A stochastic approximation method.Annals of Mathematical Statistics, 22(3):400–407, 1951

    1951

  18. [25]

    Differential privacy via distributionally robust optimization, 2024

    Aras Selvi, Huikang Liu, and Wolfram Wiesemann. Differential privacy via distributionally robust optimization, 2024

    2024

  19. [26]

    On the convergence of dp-sgd with adaptive clipping, 2024

    Egor Shulgin and Peter Richtárik. On the convergence of dp-sgd with adaptive clipping, 2024. 11

    2024

  20. [27]

    Dp-adambc: Your dp-adam is actually dp-sgd (unless you apply bias correction)

    Qiaoyue Tang, Frederick Shpilevskiy, and Mathias Lécuyer. Dp-adambc: Your dp-adam is actually dp-sgd (unless you apply bias correction). InProceedings of the 38th AAAI Conference on Artificial Intelligence, Vancouver, Canada, 2024. arXiv:2312.14334 [cs.LG]

    2024 arXiv

  21. [28]

    Thakkar, G

    O. Thakkar, G. Andrew, and H. B. McMahan. Differentially private learning with adaptive clipping.arXiv preprint arXiv:1905.03871, 2019

    1905 arXiv

  22. [29]

    Springer, New York, 1997

    Richard Tolimieri, Myoung An, and Chao Lu.Algorithms for Discrete Fourier Transform and Convolution. Springer, New York, 1997

    1997

  23. [30]

    An adaptive differential privacy method based on federated learning, 2024

    Zhiqiang Wang, Xinyue Yu, Qianli Huang, and Yongguang Gong. An adaptive differential privacy method based on federated learning, 2024

    2024

  24. [31]

    Wide residual networks.arXiv preprint arXiv:1605.07146, 2016

    Sergey Zagoruyko and Nikos Komodakis. Wide residual networks.arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  25. [33]

    DOPPLER: Differentially private optimizers with low-pass filter for privacy noise reduction

    Xinwei Zhang, Zhiqi Bu, Mingyi Hong, and Meisam Razaviyayn. DOPPLER: Differentially private optimizers with low-pass filter for privacy noise reduction. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. 12

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.